Detections
Analytics

RealPlayer for Windows Multiple Overflows (2)

medium Nessus Network Monitor Plugin ID 3286

Synopsis

The remote Windows application is affected by several overflow vulnerabilities.

Description

The installed version of RealPlayer / RealOne Player / RealPlayer Enterprise for Windows on the remote host is prone to buffer overflow and heap overflow vulnerabilities. An attacker may be able to leverage these issues to execute arbitrary code on the remote host subject to the permissions of the user running the affected application. Note that a user doesn't necessarily need to explicitly access a malicious media file since the browser may automatically pass RealPlayer skin files (ie, files with the extension '.rjs') to the application.

Solution

See http://service.real.com/help/faq/security/memory.html

See Also

http://research.eeye.com/html/advisories/published/AD20051110a.html

http://research.eeye.com/html/advisories/published/AD20051110b.html

http://www.securityfocus.com/archive/1/416475

http://service.real.com/help/faq/security/security111005.html

http://service.real.com/help/faq/security/051110_player/EN

Plugin Details

Severity: Medium

ID: 3286

Family: Web Clients

Published: 11/11/2005

Updated: 3/6/2019

Nessus ID: 20184

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.2

Vector: CVSS2#AV:A/AC:M/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.5

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:realnetworks:realplayer

Reference Information

CVE: CVE-2005-2629, CVE-2005-2630, CVE-2005-2922, CVE-2005-2936, CVE-2005-2939, CVE-2005-2940, CVE-2005-3677, CVE-2006-0323, CVE-2006-1370

BID: 15381, 17202, 15398, 15382, 15383, 15448